@ljwei-stak/dsh-model-route-bot 0.64.0 → 0.66.0

package/packages/orchestration/src/write-retry.mjs

@@ -0,0 +1,56 @@
+/**
+ * Bounded retry for SQLite write contention, and the database's own clock.
+ *
+ * Why this exists: the router ledger opens the shared connection with
+ * `busy_timeout=0` on purpose (its CAS commits must not block an await), so a
+ * borrowed journal connection inherits a non-blocking handle. A journal write
+ * that collides with another Host then fails with a bare `SQLITE_BUSY` instead
+ * of waiting, and the second Host cannot start. Read-modify-write contention on
+ * this file is expected — several Hosts, one ledger — so the failure must be a
+ * bounded wait, not a crash.
+ *
+ * Retry is synchronous on purpose: journal writes run inside a synchronous
+ * transaction and must not yield the event loop while holding a lock.
+ */
+
+const BUSY = Object.freeze(new Set(['SQLITE_BUSY', 'SQLITE_BUSY_SNAPSHOT', 'SQLITE_LOCKED']))
+
+/** Sleep without yielding: safe inside a held write transaction. */
+export function sleepSync(ms) {
+  if (!(ms > 0)) return
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(ms, 1000))
+}
+
+/** The database's own wall clock in milliseconds, independent of the caller's. */
+export function readDatabaseClock(db) {
+  const row = db.prepare("SELECT CAST(round(julianday('now')*86400000) AS INTEGER) AS ms").get()
+  if (!row || !Number.isSafeInteger(row.ms) || row.ms <= 0) throw Object.assign(new Error('SQLITE_CLOCK_UNAVAILABLE'), { code: 'SQLITE_CLOCK_UNAVAILABLE' })
+  return row.ms
+}
+
+/**
+ * Run `work` inside an immediate transaction, retrying while the file is
+ * write-locked by another connection. Any other error, including a policy
+ * refusal thrown by `work`, propagates on the first attempt.
+ */
+export function writeTransaction(db, work, { deadlineMs = 10_000, sleepMs = 10 } = {}) {
+  if (typeof work !== 'function') throw new TypeError('writeTransaction requires work')
+  const until = Date.now() + Math.max(1, deadlineMs)
+  let attempt = 0
+  for (;;) {
+    try {
+      return db.transaction(work).immediate()
+    } catch (error) {
+      if (!BUSY.has(error?.code) || Date.now() >= until) {
+        if (BUSY.has(error?.code)) {
+          throw Object.assign(new Error(`SQLITE_BUSY after ${deadlineMs}ms of retries`), {
+            code: 'SQLITE_BUSY', cause: error, sqliteCode: error?.code, deadlineMs, attempts: attempt + 1,
+          })
+        }
+        throw error
+      }
+      attempt++
+      sleepSync(Math.min(sleepMs * attempt, 100))
+    }
+  }
+}

package/remote-computer-agent/build.mjs

@@ -1,16 +1,51 @@
 import { build } from 'esbuild'
-import { copyFile, mkdir, lstat, rm } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
+import { mkdir, lstat, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
-import { resolve, relative } from 'node:path'
+import { basename, dirname, join, resolve, relative } from 'node:path'
+import { setTimeout as sleep } from 'node:timers/promises'
 import assert from 'node:assert/strict'
-const root=fileURLToPath(new URL('.', import.meta.url))
-const output=resolve(root,'dist')
-assert.equal(relative(resolve(root),output),'dist','Build output must remain in the Agent dist directory')
-const previous=await lstat(output).catch(error=>{if(error.code==='ENOENT')return null;throw error})
-assert.ok(!previous?.isSymbolicLink(),'Refusing to replace a linked build output')
-await rm(output,{recursive:true,force:true})
-const options={absWorkingDir:root,bundle:true,packages:'external',platform:'node',format:'esm',target:'node22',sourcemap:true}
-await build({...options,entryPoints:['src/index.ts','src/cli.ts'],outbase:'src',outdir:'dist',outExtension:{'.js':'.mjs'}})
-await mkdir(`${root}dist`,{recursive:true})
-await build({...options,entryPoints:['../packages/capability-broker/src/cli-stdio-bridge.mjs'],outfile:'dist/cli-stdio-bridge.mjs'})
-for(const helper of ['native-peer.ps1','native-peer.py'])await copyFile(`${root}../packages/cli-runtime/src/${helper}`,`${root}dist/${helper}`)
+
+const root = fileURLToPath(new URL('.', import.meta.url))
+const output = resolve(root, 'dist')
+assert.equal(relative(resolve(root), output), 'dist', 'Build output must remain in the Agent dist directory')
+async function checkOutput() {
+  const previous = await lstat(output).catch(error => { if (error.code === 'ENOENT') return null; throw error })
+  assert.ok(!previous?.isSymbolicLink(), 'Refusing to replace a linked build output')
+  assert.ok(!previous || previous.isDirectory(), 'Agent build output must be a directory')
+}
+await checkOutput()
+
+// Compile everything before touching the published build. Native tests run separate builders
+// while other processes import or launch these entry points; deleting dist creates an ENOENT race.
+const options = { absWorkingDir: root, bundle: true, packages: 'external', platform: 'node', format: 'esm', target: 'node22', sourcemap: true, write: false }
+const main = await build({ ...options, entryPoints: ['src/index.ts', 'src/cli.ts'], outbase: 'src', outdir: 'dist', outExtension: { '.js': '.mjs' } })
+const bridge = await build({ ...options, entryPoints: ['../packages/capability-broker/src/cli-stdio-bridge.mjs'], outfile: 'dist/cli-stdio-bridge.mjs' })
+const files = [...main.outputFiles, ...bridge.outputFiles]
+for (const helper of ['native-peer.ps1', 'native-peer.py']) {
+  files.push({ path: join(output, helper), contents: await readFile(resolve(root, '../packages/cli-runtime/src', helper)) })
+}
+for (const file of files) assert.equal(dirname(resolve(file.path)), output, 'Agent build files must remain directly inside dist')
+await checkOutput()
+await mkdir(output, { recursive: true })
+const previousFiles = await readdir(output, { withFileTypes: true })
+assert.ok(previousFiles.every(file => !file.isDirectory()), 'Unexpected directory in flat Agent build output')
+for (const file of files) {
+  const bytes = Buffer.from(file.contents)
+  const previous = await readFile(file.path).catch(error => { if (error.code === 'ENOENT') return null; throw error })
+  if (previous?.equals(bytes)) continue
+  // Temporary files stay outside dist so another builder cannot prune or package them.
+  const temporary = join(root, `.agent-build-${randomUUID()}.tmp`)
+  try {
+    await writeFile(temporary, bytes, { flag: 'wx', mode: bytes.subarray(0, 2).toString() === '#!' ? 0o755 : 0o644 })
+    for (let attempt = 0; ; attempt++) {
+      try { await rename(temporary, file.path); break }
+      catch (error) {
+        if (attempt >= 5 || !['EPERM', 'EACCES', 'EBUSY'].includes(error.code)) throw error
+        await sleep(50)
+      }
+    }
+  } finally { await rm(temporary, { force: true }) }
+}
+const names = new Set(files.map(file => basename(file.path)))
+for (const file of previousFiles) if (!names.has(file.name)) await rm(join(output, file.name), { force: true })

package/remote-computer-agent/dist/cli.mjs

@@ -2705,10 +2705,20 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../packages/capability-broker/src/authority.mjs
 var PolicyError = class extends Error {
-  constructor(code) {
+  /**
+   * `detail.gate` names the checkpoint that refused, and `detail.rule` the rule
+   * text when one matched. A refusal that only says "TOOL_DENIED" leaves the
+   * reader to guess which of several gates stopped it, and support then runs on
+   * pasted logs.
+   */
+  constructor(code, detail = {}) {
     super(`Capability refused: ${code}`);
     this.name = "PolicyError";
     this.code = code;
+    if (detail && typeof detail === "object") {
+      if (typeof detail.gate === "string" && detail.gate) this.gate = detail.gate;
+      if (typeof detail.rule === "string" && detail.rule) this.rule = detail.rule;
+    }
   }
 };